I completely agree with your arguement. However, there are a lot of legitimate websites that use fonts that may or may not be present on all computers. If the font is not present on the computer, the website can display a sightly different webpage so that the webpage can still be viewed properly. For this reason, it is neccessary to allow websites to access our list of fonts

Fonts used to display icons always need to be downloaded to make them work. Those fonts are normally never installed locally on a computer. Websites aren't able to check for installed fonts except when using a plugin like Flash or Java. Only fonts downloaded via an @font-face rule that also has a local property as a fall back can use a locally installed font.

Are you thinking of the kind of fingerprinting demonstrated on the Panopticlick site? https://panopticlick.eff.org/

In order to learn about all the fonts on your system, the site needs to use either the Flash plugin or the Java plugin. To prevent these plugins from running on untrusted sites, you can set them to "Click to Play". Of course, approving them to run allows trusted sites to read all your fonts, but there's a reasonably good chance you're letting those sites set persistent cookies or perhaps you're even logging in, so they know all about you already.

To test this out, open the Add-ons page using either:

• Ctrl+Shift+a
• orange Firefox button (or Tools menu) > Add-ons

In the left column, click Plugins. Look for the following plugins and change "Always Activate" to "Ask to Activate":

• Java(TM) Platform SE
• Shockwave Flash

When you visit a site that wants to use Java or Flash, you should see a notification icon in the address bar and one of the following: a link in a black rectangle in the page or an infobar sliding down between the toolbar area and the page.

Of course, some pages use these plugins just for nice advertising or to store/retrieve tracking data on your computer, so you really only need to allow it where there is some program/media you want to run/play.

Yes, that's exactly the fingerprinting I'm referring to. Thank you, it's good to know that it can be blocked using the method you mentioned. It appears the Flashblock add-on also blocks it, which is excellent for me because I use Flashblock on almost all of my computers. However, I'm not just concerned about me. I'm also concerned about the privacy & security of other users and the betterment of Firefox. Many users now know about cookies and the importance of blocking them or clearing them regularly, or using an add-on to help handle them, but most users don't know that websites can obtain this other information (particularly the font information) so they're not making any necessary adjustments, such as those you suggested, or installing an add-on like Flashblock. I understand that it's useful for developers to have this information but I don't see that as justification. Just because some information is useful for them doesn't mean they necessarily should have it, or need to have it. I'd like to see Firefox incorporate something that prevents Firefox/flash from reporting the font information by default, accompanied by a one-time prompt that lets the user know the reporting is being blocked, plus the pros & cons of blocking it, and an option to unblock it. At the very least, I'd like to see a button added to the Firefox privacy settings that users can click to see what information the browser/flash is reporting (just like the panopticlick site you mentioned), along with an option to prevent the browser/flash from from reporting some (or all) of that information. Firefox is a great browser and I want it to continue to get better, and I want to see it continue to be the browser that empowers people and has the highest respect for their privacy & security. PS: I'm not just concerned about the font data being used to track people; I'm also concerned about the font names themselves. I found out about this whole font data thing when a friend asked me to beta test a forum he's building. After visiting the forum, he sent me a message listing all of the information that was automatically collected about me upon visiting the forum. The font data was included, and amongst that data were the names of many fonts that I had downloaded over the years; names that revealed a lot about my personal interests. A few of them were actually quite embarrassing (I never though in a million years Firefox could be revealing those font names to websites). The friend I mentioned was planning to use the font data (plus other reported data) to track banned users who change their IP address then create a new account.